117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e

Analysis

max time kernel
149s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2022, 16:37

Target

117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe
Size

1.3MB
MD5

24cc44610e2656d5fa337dfe274c6454
SHA1

2c9990afb9435ba8347a44e76cde8aace07361f5
SHA256

117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e
SHA512

b784159f7015f19959fb4c13bb2b142910424f7ade9afeeedc4bb74d172abda0a74386ba71d3807354ed339c1e9d7e84bc66ea9f6333f8a39c9bce5d9958fcdd
SSDEEP

24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak6:zrKo4ZwCOnYjVmJPa9

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3804	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe
3804	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe
3804	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe
3804	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe
3804	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85
PID 1968 wrote to memory of 3804	1968	117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe	85

C:\Users\Admin\AppData\Local\Temp\117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe
"C:\Users\Admin\AppData\Local\Temp\117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\117d50a1e20e920b7c0f64ff3272f146148c2b7495e24cad0a4c45dbc5e4f36e.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3804

memory/3804-133-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3804-134-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3804-135-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3804-136-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3804-137-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/3804-138-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download